Online custom vehicle picker - repair notes

Observed evidence

The latest local online log contains available picker entries for both players,
including Slash and Fungus, but no native-menu drawing entry. The session keeps
running. This fits the reported working left/right input and invisible menu.

In the final composed trackmenu_setup_render, event 103 checks picker state
through dkr_legacy_track_menu. The private import dispatches to ModWorld, which
temporarily installs WorldScope. It then returns and restores the prior scope.
The next direct dkr_vehicle_menu_draw import looks up current_world() after
that scope has ended. It therefore reads ordinary_world instead of the owned
online world's vehicles. The retired ordinary picker is inactive or absent,
and drawing returns without rendering anything.

Repair

Only the two owned generated menu bodies are copied and patched. Their direct
draw call becomes a zero-argument dkr_owned_vehicle_menu_draw service request.
The private driver supplies revision-local, internal-linkage callbacks for
menu_element_render and get_text_width. Each runs through dkr_probe_run_native,
with float-register binding and failure-to-exception conversion, matching the
existing checked callback convention. No unguarded guest callback is added.

A stack-scoped native binding exposes those two callbacks only while the owned
ModWorld dispatch installs WorldScope and invokes the existing World::draw.
The binding restores its previous state on both success and exception unwind.
No host pointer is passed through the guest operation or serialized. Existing
private menu-texture/font calls remain in use. Arity, owner and callback checks
fail closed through the existing owned service error boundary.

The offline draw import, menu input and selection state, checkpoint format,
vehicle resources, driver placement, CPU car choices and renderer are unchanged.
Both ROM revision contracts include this repair; the ledger hashes authored
files using relative names so Windows and Linux produce matching peer IDs.

Validation and delivery

configure.py composes the accepted detail/records repair and all preceding
features. All new outputs are in external build-local stages. audit.py verifies
input/output hashes, both revision hooks, private callback boundaries, ordinary
guest source preservation, retained upstream repairs and linked feature markers.
package.py creates allowlisted fresh Windows ZIP and Linux x86_64 AppImage
packages with receipts, hashes and a short owner gameplay checklist.

No game, mod, test executable or AppImage is launched by this workflow. The
source defect is corrected and compilation/static checks are performed, but
online visual and controller behaviour require the owner's gameplay approval.
